ur-agent 1.45.5 → 1.46.0

package/docs/A2A.md

@@ -0,0 +1,143 @@
+# Agent2Agent (A2A)
+
+UR exposes an opt-in agent-to-agent server with two deliberately distinct API
+surfaces:
+
+| Surface | Path | Contract |
+| --- | --- | --- |
+| Agent Card | `/.well-known/agent-card.json` | Public discovery metadata that exactly describes the running server |
+| A2A JSON-RPC | `/a2a/jsonrpc` | A2A protocol v0.3, implemented with the official stable JavaScript SDK |
+| UR compatibility API | `/a2a/tasks` and `/a2a/tasks/:id` | UR-specific REST-style background-task controls; not an A2A REST binding |
+
+The A2A specification itself is at v1. UR does not claim v1 conformance yet:
+the official JavaScript SDK's v1 support is prerelease, while its current
+stable line implements v0.3. UR will migrate and run the official conformance
+suite when a stable JavaScript v1 path is available.
+
+## Start the server
+
+Loopback without authentication is allowed for local development:
+
+```sh
+ur a2a serve --port 8765
+```
+
+For authenticated use, keep secrets out of process arguments:
+
+```sh
+UR_A2A_TOKEN='<random-secret>' ur a2a serve --port 8765
+```
+
+An off-loopback bind requires either `UR_A2A_TOKEN` or
+`UR_A2A_DELEGATION_SECRET`. A wildcard bind also requires a reachable external
+base URL so the Agent Card never advertises `0.0.0.0`:
+
+```sh
+UR_A2A_TOKEN='<random-secret>' \
+  ur a2a serve --host 0.0.0.0 --port 8765 \
+  --public-base-url https://agent.example.com
+```
+
+Terminate TLS at a trusted reverse proxy for non-loopback deployments; bearer
+tokens must not travel over plaintext networks.
+
+## Agent Card and protocol calls
+
+Inspect the live card:
+
+```sh
+curl -s http://127.0.0.1:8765/.well-known/agent-card.json
+```
+
+The card advertises protocol `0.3.0`, `JSONRPC`, `/a2a/jsonrpc`, unary task
+execution, the installed UR version, skills, and only the authentication
+schemes actually configured for that server.
+
+Send a blocking message:
+
+```sh
+curl -s http://127.0.0.1:8765/a2a/jsonrpc \
+  -H 'content-type: application/json' \
+  -H 'A2A-Version: 0.3' \
+  -H "authorization: Bearer $UR_A2A_TOKEN" \
+  -d '{
+    "jsonrpc":"2.0",
+    "id":"request-1",
+    "method":"message/send",
+    "params":{
+      "configuration":{"blocking":true},
+      "metadata":{"skill":"coding-agent"},
+      "message":{
+        "kind":"message",
+        "messageId":"message-1",
+        "role":"user",
+        "parts":[{"kind":"text","text":"Review the current diff."}]
+      }
+    }
+  }'
+```
+
+Set `configuration.blocking` to `false` to receive a working task promptly,
+then call `tasks/get`; use `tasks/cancel` for a nonterminal task. The stable
+binding supports `message/send`, `tasks/get`, and `tasks/cancel`. Streaming,
+resubscription, push notifications, and authenticated extended cards are not
+advertised and return protocol errors if requested.
+
+`params.metadata.skill` selects an advertised skill; the default is
+`coding-agent`. Requests with an unknown skill are rejected before execution.
+Prompts enter the child process through stdin, and the child uses fail-closed
+`dontAsk` permissions because this network binding has no interactive approval
+bridge.
+
+## Delegation tokens
+
+UR delegation tokens are short-lived HMAC-signed capabilities bound to a
+subject, one audience, an expiry, and explicit skill scopes:
+
+```sh
+export UR_A2A_DELEGATION_SECRET='<issuer-secret>'
+TOKEN=$(ur a2a token mint --sub peer-a --aud ur-nexus \
+  --scope coding-agent --ttl 900)
+printf '%s\n' "$TOKEN" | ur a2a token verify --token-stdin \
+  --aud ur-nexus --scope coding-agent
+```
+
+The HMAC secret belongs only to the trusted issuer. A narrower child token can
+be minted by that issuer, but an untrusted holder cannot attenuate the token
+without the root signing secret. Protocol and compatibility tasks are isolated
+by both delegation subject and skill, including get, continue, reference, and
+cancel operations.
+
+## UR compatibility task API
+
+The compatibility API preserves older UR-specific background options:
+
+- `POST /a2a/tasks` — submit `{ prompt, skill, mode, worktree, model, maxTurns }`
+- `GET /a2a/tasks` — list tasks visible to the caller
+- `GET /a2a/tasks/:id` — status
+- `GET /a2a/tasks/:id/output` — bounded output metadata and logs
+- `POST /a2a/tasks/:id/cancel` or `DELETE /a2a/tasks/:id` — cancel
+
+These routes do not use the A2A wire schema and must not be presented to A2A
+clients as an A2A REST endpoint. `skipPermissions` additionally requires the
+static operator token or a delegation scope of `permissions:bypass`.
+
+## Operational limits
+
+The server bounds work with these environment variables:
+
+- `UR_A2A_MAX_REQUEST_BYTES` and `UR_A2A_MAX_PROMPT_CHARS`
+- `UR_A2A_MAX_OUTPUT_BYTES`
+- `UR_A2A_MAX_SUBMISSIONS_PER_MINUTE`
+- `UR_A2A_MAX_CONCURRENT_SUBMISSIONS`
+- `UR_A2A_MAX_ACTIVE_TASKS`
+- `UR_A2A_MAX_ACTIVE_TASKS_PER_OWNER`
+- `UR_A2A_TASK_TIMEOUT_MS`
+
+Protocol task state is persisted with owner and skill metadata in
+`.ur/a2a/protocol-tasks.json` using owner-only file permissions. UR
+compatibility task state remains under the same `.ur/a2a/` directory and links
+to `.ur/background/` output files.
+
+References: [A2A v1 specification](https://a2a-protocol.org/latest/specification/),
+[official JavaScript SDK](https://github.com/a2aproject/a2a-js).

package/docs/ACP.md

@@ -1,13 +1,14 @@
-# Agent Communication / Client Protocol (ACP)
+# Agent Client Protocol (ACP)
 
-UR exposes two ACP surfaces:
+UR exposes one native ACP transport and one separate HTTP integration surface:
 
-1. **Stdio ACP agent** (`ur acp stdio`) — newline-delimited JSON-RPC over stdio,
-   the protocol Zed and ACP-capable editors speak. Use this for native editor
-   integration.
-2. **HTTP JSON-RPC server** (`ur acp serve`) — a loopback HTTP endpoint for
-   scripting, task delegation, and custom clients. This is **not** Zed-style
-   stdio ACP; use the stdio agent for native ACP editors.
+1. **Stdio ACP agent** (`ur acp stdio`) — the stable ACP v1 wire protocol over
+   newline-delimited JSON-RPC, implemented with the official TypeScript SDK.
+   Use this for Zed and other native ACP clients.
+2. **UR HTTP JSON-RPC compatibility server** (`ur acp serve`) — a separate
+   loopback endpoint for scripting, the experimental JetBrains plugin, tool
+   calls, and background tasks. It is not an ACP transport binding and is not
+   advertised as one.
 
 ## Stdio ACP agent
 
@@ -16,6 +17,8 @@ ur acp stdio
 ```
 
 The editor launches this process and exchanges one JSON-RPC object per line.
+The official SDK owns wire parsing, request concurrency, notification
+semantics, and error envelopes.
 
 Methods:
 
@@ -24,9 +27,11 @@ Methods:
 | `initialize` | client → agent | `{ protocolVersion, agentCapabilities, authMethods }` |
 | `authenticate` | client → agent | `{}` (no auth required for local stdio) |
 | `session/new` | client → agent | `{ sessionId }` |
+| `session/resume` | client → agent | restores a persisted session without replaying history |
+| `session/close` | client → agent | cancels active work and releases the in-process session |
 | `session/prompt` | client → agent | `{ stopReason }`, with streaming `session/update` notifications |
 | `session/cancel` | client → agent (notification) | aborts the in-flight prompt |
-| `shutdown` | client → agent | `null` |
+| `session/request_permission` | agent → client | asks the user to allow or reject a tool call |
 
 During `session/prompt` the agent emits `session/update` notifications:
 
@@ -38,22 +43,61 @@ During `session/prompt` the agent emits `session/update` notifications:
 ```
 
 `session/prompt` resolves with `{ "stopReason": "end_turn" }` (or `"cancelled"`
-if a `session/cancel` arrived). Configure it with `ur ide config zed`.
+if a `session/cancel` arrived). Repeated prompts resume the underlying UR CLI
+conversation for that ACP session. Stable `session/resume` reconnects after an
+agent restart without replaying history; UR stores only the ACP-to-CLI session
+identity and working directory in mode-`0600` metadata under
+`~/.ur/acp/sessions/`. MCP credentials are never written there. Configure the
+agent with `ur ide config zed`.
+
+The stdio surface advertises text and resource-link prompt support, additional
+workspace directories, MCP stdio/HTTP/SSE transports, and stable resume/close
+capabilities. Client-provided MCP configuration is validated, written to a
+mode-`0600` temporary file instead of argv, and removed after each turn. Image,
+audio, embedded-context, and `session/load` capabilities are not advertised;
+`session/load` requires full history replay, while `session/resume` deliberately
+does not replay it.
+
+Tool calls that require approval are bridged to the client's native ACP
+permission UI with allow-once, reject, and (when UR supplies a durable rule)
+always-allow choices. Cancellation and client errors fail closed. The prompt is
+sent over stdin rather than argv. Session count, prompt size, output size, and
+runtime are bounded by `UR_ACP_STDIO_MAX_SESSIONS`,
+`UR_ACP_STDIO_MAX_PROMPT_CHARS`, `UR_ACP_STDIO_MAX_OUTPUT_CHARS`, and
+`UR_ACP_STDIO_PROMPT_TIMEOUT_MS`.
 
 ## HTTP JSON-RPC server
 
 ```sh
-ur acp serve --host 127.0.0.1 --port 8123 [--token <secret>] [--debug]
+UR_ACP_TOKEN='<secret>' ur acp serve --host 127.0.0.1 --port 8123 [--debug]
 ur acp status [--json]
 ur acp stop
 ```
 
-Binds to loopback only; binding off-loopback requires `--token`. `--debug` logs
-each method and outcome to stderr. POST JSON-RPC to `/acp`; `GET /healthz`
-returns `{ ok: true }`.
+Binds to loopback by default; binding off-loopback requires a bearer token.
+Prefer `UR_ACP_TOKEN` because command-line secrets may be visible to other
+local processes. `--debug` logs method names and outcomes—not request params or
+secrets—to stderr. POST JSON-RPC to `/acp`; `GET /healthz` returns `{ ok: true }`.
+
+Tool calls are schema-validated and pass through the normal permission engine.
+Because the HTTP API has no interactive approval channel, requests that need an
+approval fail closed. Requests, prompts, tool I/O, task submission rate, tool
+call rate, concurrency, retained sessions/tasks, response size, and runtime are
+bounded. A session may select an existing subdirectory of the configured server
+workspace, but cannot escape that root (including through symlinks). Deployments
+can tune these defaults with `UR_ACP_MAX_REQUESTS_PER_MINUTE`,
+`UR_ACP_MAX_CONCURRENT_REQUESTS`, `UR_ACP_MAX_REQUEST_BYTES`,
+`UR_ACP_MAX_RESPONSE_BYTES`, `UR_ACP_MAX_ERROR_CHARS`,
+`UR_ACP_MAX_PROMPT_CHARS`, `UR_ACP_MAX_SESSIONS`,
+`UR_ACP_MAX_ACTIVE_TASKS`, `UR_ACP_MAX_RETAINED_TASKS`,
+`UR_ACP_MAX_TASKS_PER_MINUTE`, `UR_ACP_MAX_CONCURRENT_TASKS`,
+`UR_ACP_MAX_TASK_OUTPUT_BYTES`, `UR_ACP_TASK_TIMEOUT_MS`,
+`UR_ACP_MAX_TOOL_CALLS_PER_MINUTE`, `UR_ACP_MAX_CONCURRENT_TOOL_CALLS`,
+`UR_ACP_TOOL_TIMEOUT_MS`, `UR_ACP_MAX_TOOL_INPUT_CHARS`, and
+`UR_ACP_MAX_TOOL_OUTPUT_CHARS` environment variables.
 
 Methods: `initialize` (returns `capabilities` and `workspaceRoot`),
-`session/new`, `session/prompt`, `session/cancel`, `tools/list`, `tools/call`,
+`session/new`, `session/prompt`, `session/cancel`, `session/close`, `tools/list`, `tools/call`,
 `tasks/send` / `tasks/get` / `tasks/cancel`, `ide/diffCapture`, `ide/select`,
 and `shutdown` (acknowledges, then stops the server).
 
@@ -75,8 +119,8 @@ curl -s http://127.0.0.1:8123/acp \
 
 ## Capabilities and limitations
 
-- The stdio agent streams via `session/update`; token-level granularity depends
-  on the active provider.
+- The stdio agent streams text deltas via `session/update`; chunk granularity
+  depends on the active provider's stream.
 - The HTTP server returns unary responses (`streaming: false`); use the stdio
   agent for incremental updates.
 - Neither surface silently falls back to another provider; dispatch failures are

package/docs/AGENT_FEATURES.md

@@ -9,6 +9,30 @@ reproducible autonomous software engineering agent: every substantial task can
 be driven as `spec -> plan -> patch -> test -> report -> rollback`, with the
 spec as the durable source of truth and command evidence as the success gate.
 
+## v1.46.0 Additions
+
+- Native ACP v1 stdio support now uses the official SDK and includes durable
+  sessions, resume/close, MCP server configuration, additional roots,
+  permission requests, cancellation, and streaming updates. The separate HTTP
+  automation API is documented as UR JSON-RPC rather than mislabelled ACP.
+- A2A interoperability now uses the official stable JavaScript SDK for the
+  advertised v0.3 JSON-RPC binding, with authenticated discovery, scoped
+  delegation, durable tasks, cancellation, and bounded request execution.
+- The VS Code Actions view can safely start, inspect, and cancel background
+  tasks, including isolated worktree execution. The JetBrains client now
+  propagates cancellation, rejects overlapping prompts, and closes sessions.
+- Background-task state uses locked, atomic, private manifest writes with
+  corruption detection, structural limits, and symlink-safe artifact paths.
+- Provider protocol handling, MCP validation, CI supply-chain controls, release
+  version checks, and secret-input paths received additional compatibility and
+  security coverage.
+
+## v1.45.6 Additions
+
+- Project verification approval is deduplicated per user turn. The agent asks
+  once before the final compile/test/lint commands, then respects that decision
+  without presenting the same gate again.
+
 ## v1.45.5 Additions
 
 - Ollama Cloud requests have bounded response-header and streaming phases and
@@ -175,7 +199,7 @@ components instead of one giant prompt.
 
 | Addition | Surface | What it adds |
 | --- | --- | --- |
-| ACP server for IDE extensions | `ur acp serve\|stop\|status` | HTTP+JSON-RPC Agent Communication Protocol server that exposes tool listing, tool calls, task submission, and status for VS Code/Cursor/Zed-like editors. |
+| ACP and IDE transports | `ur acp stdio`; `ur acp serve\|stop\|status` | Official-SDK ACP v1 stdio agent for native ACP editors, plus a distinct UR HTTP JSON-RPC API for tools, tasks, scripts, and the experimental JetBrains plugin. |
 | Non-interactive pool execution | `ur exec [prompts...]` | Run one or more prompts headlessly with optional concurrency, worktrees, output capture, and dry-run. |
 | GitHub tool | `GitHub` | PR/issue/repo operations via the `gh` CLI. |
 | API tool | `Api` | REST HTTP calls with JSON/text output. |
@@ -234,7 +258,7 @@ and route model work through the local Ollama-backed UR runtime.
 | Auto compaction and memory retention | `compaction.autoThreshold`, `ur memory retention` | Configurable context compaction threshold plus TTL/max/decay pruning for `.ur/memory/*.jsonl` |
 | Code-index auto-reindex | `codeIndex.autoReindex`, `ur code-index watch` | File watcher that rebuilds the local semantic code index after source changes |
 | Live artifact steering | `ur artifacts comment <id> --feedback ... --task <bg_id>` | Artifact feedback is queued into the linked background task inbox and injected into active stream-json background agents as `priority: "now"` turns |
-| Full opt-in A2A task server | `ur a2a serve`, `/a2a/tasks` lifecycle routes | Token/delegation-protected task submission, status, output, and cancel routes backed by local background tasks |
+| Opt-in A2A + compatibility server | `ur a2a serve`, `/a2a/jsonrpc`, `/a2a/tasks` | Official-SDK A2A v0.3 JSON-RPC task lifecycle plus clearly separate token/delegation-protected UR background-task compatibility routes |
 | IDE inline diff bundles | `ur ide diff capture|list|show|comment|schema`, `extensions/vscode-ur-inline-diffs/` | Editor-readable `.ur/ide/diffs/` manifest, metadata, patch files, comments, plus a native VS Code tree/webview review extension |
 | Benchmark adapters | `ur eval bench swe-bench|terminal-bench|aider-polyglot` | Imports local benchmark JSON/JSONL exports into UR eval suites without external downloads |
 
@@ -247,7 +271,7 @@ and route model work through the local Ollama-backed UR runtime.
 | Model capability report | `ur model-doctor` | Local Ollama model inventory with context length, advertised capabilities, and likely vision/code readiness |
 | Reusable agent templates | `ur agent-templates install` | Project agents for review, tests, browser QA, docs research, security, release notes, PR fixes, and memory curation |
 | GitHub agent runner | `.github/workflows/ur.yml` scaffold | Opt-in CI entry point for manual prompts or `/ur` issue comments |
-| A2A adapter handoff | `ur a2a serve` | Loopback Agent Card and token-gated task execution endpoint |
+| A2A interoperability | `ur a2a serve` | Accurate Agent Card, stable A2A v0.3 JSON-RPC binding, and separate UR compatibility task API; A2A v1 waits for the official stable JS SDK |
 | Semantic memory index | `ur semantic-memory build|search` | Local memory index over durable memory, docs, README, and UR instructions |
 | Claim provenance ledger | `ur claim-ledger add|list|validate` | Maps generated claims to web, file, MCP, tool, or user sources |
 | Browser replay evals | `ur browser-qa list|validate|run` | Validates replay fixtures and performs lightweight target smoke checks |
@@ -262,7 +286,7 @@ tasks, custom agents, memory files, browser workflows, evidence commands, A2A
 Agent Card export, and local Ollama routing; these surfaces make those
 capabilities easier to discover and reuse.
 
-Network-facing behavior, such as a full A2A task server or a GitHub bot that can
+Network-facing behavior, such as the opt-in A2A server or a GitHub bot that can
 push code, should remain explicitly opt-in because it changes the trust and
 permission boundary.
 

package/docs/AGENT_TRENDS.md

@@ -1,7 +1,10 @@
 # Agent Trend Coverage
 
-UR is a local-first terminal coding agent. This page tracks how UR maps to the
-current agent platform trends and where future work should go next.
+UR is a provider-flexible, local-first terminal coding agent. This page tracks
+how UR maps to current agent-platform trends and where future work should go
+next. The factual comparison below is a **2026-07-15 research snapshot**; run
+`ur agent-trends` for the versioned machine-readable report and re-check the
+linked primary sources before acting on prerelease standards.
 
 ## Quick Commands
 
@@ -66,12 +69,14 @@ Inside an interactive session:
 
 | Trend | UR status | Current coverage | Professional next step |
 | --- | --- | --- | --- |
-| Local-first model runtime | Covered | local Ollama app endpoint, local and Ollama Cloud-backed models exposed through that app, model auto-routing | Add model capability reporting for tools, vision, context length, and multimodal readiness |
-| MCP tool ecosystem | Covered | `ur mcp`, MCP OAuth/XAA helpers, elicitation, permission checks, shared tool registry | Keep MCP registry/security guidance current as the spec evolves |
-| A2A / Agent Card interoperability | Covered | `ur a2a card`, `/a2a-card`, and opt-in `ur a2a serve` with task lifecycle routes and bearer/delegation auth | Track A2A spec changes and keep the server disabled unless explicitly started |
+| Provider-flexible, local-first runtime | Covered | Local Ollama; direct OpenAI, Anthropic, Gemini, OpenRouter, and OpenAI-compatible APIs; authenticated subscription-CLI adapters; explicit provider selection | Normalize capability discovery across providers and make automatic per-step routing opt-in |
+| MCP tool ecosystem | Covered | `ur mcp`, MCP OAuth/XAA helpers, elicitation, fail-closed permission checks, bounded execution, shared tool registry | Keep the production v1 SDK pinned while testing the final 2026 stateless-core transition separately |
+| MCP Tasks and MCP Apps | Adapter-ready | UR's durable task engine could back protocol tasks, but UR advertises neither experimental Tasks nor an Apps renderer | Prototype negotiated extensions; ship only against a final spec and production SDK, with context-bound task auth and cancellation |
+| A2A / Agent Card interoperability | Partial | Official-SDK A2A v0.3 Agent Card + JSON-RPC binding at `/a2a/jsonrpc`; separate UR compatibility task routes; bearer/delegation auth | Add a negotiated v1 dual stack, signed-card verification, and official TCK coverage when the JavaScript SDK v1 line is stable |
 | Durable workflows and checkpoints | Covered | resume, rewind, `ur bg` background runs, optional worktrees/PRs, cron/workflow internals, file restore | Publish a checkpointed workflow format for repeated automations |
 | Multi-agent orchestration | Covered | built-in planning, exploration, verification, and general-purpose agents; custom agents | Document reusable team patterns and role selection |
-| Long-term memory | Covered | `/remember`, `/forget`, `.ur/memory`, semantic memory, research notes, team memory, consolidation, `ur memory retention` | Tune retention defaults from real long-run telemetry |
+| Long-term memory | Partial | `/remember`, `/forget`, `.ur/memory`, optional local dense retrieval plus lexical fallback, semantic code search, provenance, consolidation, retention | Add scope deletion guarantees and integrity baselines, quarantine, and rollback for poisoned memory writes |
+| Portable Agent Skills | Partial | Project/user/plugin/remote/bundled `SKILL.md` support, lazy Skill tool, creation and skillification, skill-scoped permissions | Add strict open-spec validation plus signed provenance and permission manifests before community-registry installation |
 | Semantic codebase retrieval | Covered | local embedding-based code index (`ur code-index`), opt-in `CodeSearch` tool, incremental re-index, auto-reindex watcher, Ollama embeddings | Add richer symbol-aware ranking |
 | Reliable repo editing | Covered | `ur repo-edit` builds a file/symbol index, performs AST-aware JS/TS identifier rename planning, previews patches before writing, and applies multi-file edits transactionally with rollback on syntax or check failure | Extend AST edits beyond identifier rename into import moves and signature-aware refactors |
 | Permission and safety policy | Covered | `ur safety`, `.ur/safety-policy.json`, pre-Bash safety evaluation, read/write/execute/network command classes, destructive-command approval, sandbox recommendations, and secret exfiltration denial | Record sandbox attestation in every risky command's evidence trail |
@@ -79,18 +84,20 @@ Inside an interactive session:
 | AGENTS.md interoperability | Covered | `AGENTS.md` loaded as runtime project context (before `UR.md`), plus imported by the `/init` command | Keep aligned as the AGENTS.md spec evolves |
 | Browser and computer-use workflows | Covered | `/browser`, `/chrome`, Playwright-aware tasks, WebSearch, WebFetch, risky-action approval | Add more release fixtures with screenshots and replay assertions |
 | Provenance and citations | Partial | WebFetch source URLs, `/cite`, `/graph`, `/trace`, evidence ledgers | Add claim-to-source mapping for web/MCP answers |
-| Evals and observability | Covered | verifier gates, `.ur/verify.json`, `/verify`, `/trace`, OpenTelemetry hooks, release checks, eval dashboard, benchmark adapters | Publish benchmark numbers from local reproducible suites |
+| Evals and observability | Partial | verifier gates, `.ur/verify.json`, `/verify`, `/trace`, OpenTelemetry hooks, replayable evals, dashboard, benchmark adapters | Grade complete trajectories in CI and publish versioned pass rates by category |
+| Standard GenAI telemetry | Partial | Internal interaction/model/tool/agent/hook spans and bounded Perfetto traces | Dual-emit current OpenTelemetry GenAI semantics with sensitive content redacted by default |
 | Test-first execution | Covered | `ur test-first` detects compile/test/lint commands, stores failure traces, retries through a fix agent, and installs detected commands into `.ur/verify.json` for edit-time gates | Add per-package command plans for large monorepos |
-| Security and prompt-injection resistance | Covered | allow/ask/deny permissions, shell safety analysis, secret scan, untrusted web-content guidance, OS-level execution sandbox (macOS Seatbelt, Linux bubblewrap) | Continuously test web/MCP injection cases |
-| Agent identity and delegated authorization | Covered | MCP OAuth/XAA helpers, A2A bearer/delegation tokens, local trust boundaries, permission rules | Keep delegated scopes narrow and auditable |
+| Security and prompt-injection resistance | Covered | allow/ask/deny permissions, shell safety analysis, secret scan, untrusted web-content guidance, OS-level execution sandbox (macOS Seatbelt, Linux bubblewrap) | Continuously test web/MCP/repository/skill/memory injection, confused-deputy, and tool-abuse cases |
+| Agent identity and delegated authorization | Covered | MCP OAuth/XAA helpers, issuer-minted A2A bearer/delegation tokens, subject/audience/expiry/skill binding, local trust boundaries, permission rules | Keep delegated scopes narrow and auditable; HMAC child-token narrowing remains issuer-side |
 | Multimodal workflows | Partial | `/image`, `/video`, `/youtube`, `/voice`, browser workflows | Add model-aware multimodal capability reporting for local Ollama setups |
 | Spec-driven development | Covered | `ur spec` scaffolds requirements/design/tasks under `.ur/specs/`, tracks phase/approvals, and runs the Spec Kit / Kiro task list one task at a time | Add bidirectional sync with an external `specs/` directory |
 | Capability-aware model escalation | Covered | `ur escalate` selects fast/oracle tiers from `model-doctor`, runs routine work fast, and auto-escalates hard/failed work to the strong local model | Learn per-model success rates to tune the difficulty threshold |
 | Best-of-N agent judging | Covered | `ur arena` runs N agents per task in isolated worktrees and judges diffs with the self-review gate; winner is selectable/appliable | Add an optional model judge alongside the deterministic scorer |
 | Self-healing CI | Covered | `ur ci-loop` reports its resolved cwd, preserves assertion/stack context, stops no-test configuration failures before invoking a fixer, and re-runs real failures with bounded retries; commits/pushes require explicit flags and are self-review gated | Wire to `ur trigger` so a failed CI webhook can explicitly launch the loop |
 | Verifiable artifacts | Covered | `ur artifacts` records plans/diffs/test-runs with approve/reject/feedback under `.ur/artifacts/`; comments steer active background agents through stream-json inbox injection | Attach browser-QA screenshots and link artifacts to claim-ledger entries |
-| Native IDE review | Covered | `ur ide diff` writes `.ur/ide/diffs/` bundles and `extensions/vscode-ur-inline-diffs/` provides a VS Code tree/webview/comment surface | Add JetBrains packaging if demand appears |
-| ACP / IDE agent server | Covered | `ur acp serve|stop|status` exposes an HTTP+JSON-RPC agent server so VS Code/Cursor/Zed extensions can list tools, call tools, and submit tasks | Ship reference editor extensions |
+| Native IDE review | Covered | `ur ide diff` bundles, a VS Code tree/webview/comment surface with background task controls, and a buildable JetBrains ACP client with cancellation | Add signed marketplace packaging and keep behavior parity covered in editor-host integration tests |
+| ACP / IDE agent server | Partial | Official-SDK ACP v1 stdio agent with permission requests, MCP stdio/HTTP/SSE, additional roots, persistent resume, close, and cancellation; separate UR HTTP JSON-RPC for scripts | Add paginated `session/list`/`session/delete`, then exact-history `session/load`; advertise config/slash capabilities only when complete |
+| Provider-native durable inference | Partial | UR provides provider-independent background processes and local compaction, while direct OpenAI requests still use Chat Completions | Add an opt-in Responses adapter for background/WebSocket execution, server compaction, and deferred tool discovery with privacy-aware defaults |
 | External tool integration | Covered | Built-in `GitHub`, `Api`, `Browser`, `Docker`, `TestRunner`, and `Database` tools complement existing file-system, terminal, web, and MCP tools | Add richer output parsing and error recovery |
 
 ## v1.13.9 Direct CLI Surfaces
@@ -111,18 +118,62 @@ ur artifacts capture-tests --command "bun test"
 
 ## A2A Position
 
-UR exports an Agent Card so other tools can discover what UR is and what it can
-do. `ur a2a serve` is the opt-in task server: it exposes health, Agent Card,
-task submission, task listing, task status, output, and cancellation routes. It
-refuses off-loopback binds unless bearer or delegation authentication is
-configured, and task execution stays backed by local UR background tasks.
+`ur a2a serve` exposes a real A2A v0.3 JSON-RPC binding, implemented by the
+official stable JavaScript SDK, at `/a2a/jsonrpc`. Its discoverable Agent Card
+is served at `/.well-known/agent-card.json`; the advertised URL, transport,
+protocol version, capabilities, and configured security schemes match the
+running server. Protocol tasks are durable under `.ur/a2a/`, and retrieval,
+continuation, references, and cancellation are isolated by delegation subject
+and skill scope. Streaming and push notifications are not advertised.
+
+The existing `/a2a/tasks` submission/list/status/output/cancel routes are a
+separate **UR compatibility API**, not an A2A REST binding. They remain useful
+for UR background-task options such as worktrees and bounded turns. On these
+routes, `skipPermissions` is rejected unless the caller uses the static
+operator token or a token that grants `permissions:bypass`; the official A2A
+runner always uses fail-closed `dontAsk` permissions.
+
+The server refuses unauthenticated off-loopback binds and requires
+`--public-base-url` for wildcard binds so discovery never advertises
+`0.0.0.0`. Prefer `UR_A2A_TOKEN` and `UR_A2A_DELEGATION_SECRET` over argv
+secrets. Request size, prompt size, output size, submission rate, concurrent
+submissions, and active tasks are bounded by `UR_A2A_*` settings. The current
+A2A protocol release is v1, but the official JavaScript SDK's stable line still
+implements v0.3 and its `next` v1 line is beta. UR deliberately stays on the
+official stable v0.3 binding until a production v1 SDK and conformance path are
+available, then should run both versions during a negotiated migration.
 
 ## Model Runtime Position
 
-UR intentionally sends model requests only to the local Ollama app. If that app
-exposes local models or Ollama Cloud-backed models, UR treats them the same way:
-as models available through the local Ollama endpoint. This keeps provider
-configuration out of UR and avoids direct model API key handling.
+UR is local-first, not local-only. Ollama supports private on-device execution;
+direct adapters support OpenAI, Anthropic, Gemini, OpenRouter, and compatible
+endpoints; subscription adapters use the provider's authenticated CLI. Provider
+and model selection are explicit, credentials are resolved through the
+credential layer, and the optional fallback setting is diagnostic advice rather
+than an automatic provider switch.
+
+## 2026-07-15 Frontier Priorities
+
+The research conducted after the `1.46.0` version bump produced this ordered
+backlog. Prerelease protocol work should remain behind capability flags and must
+not replace the production path until its SDK and conformance tooling are stable.
+
+1. Add an A2A v1 dual stack with version negotiation, signed Agent Card
+   verification, multi-tenant isolation, and official TCK coverage.
+2. Complete ACP's durable session lifecycle with paginated `session/list` and
+   `session/delete`; implement `session/load` only with exact ordered replay.
+3. Prepare for MCP's stateless core and negotiated Tasks/Apps extensions on a
+   compatibility branch. The announced 2026-07-28 specification is not yet the
+   production baseline for this snapshot.
+4. Add an opt-in Responses adapter: privacy-aware background execution,
+   authenticated webhooks or bounded polling, WebSocket continuation, opaque
+   compaction preservation, and deferred tool search.
+5. Adopt OpenTelemetry GenAI semantic conventions and trace graders as CI
+   regression gates without exporting prompts, tool arguments, retrieval
+   queries, or results by default.
+6. Treat durable memories and installable skills as supply-chain inputs:
+   validate provenance, constrain capabilities, quarantine suspicious writes,
+   and provide integrity snapshots and rollback.
 
 ## Source And Trust Policy
 
@@ -141,13 +192,23 @@ Professional answer requirements:
 
 ## References
 
-- OpenAI Agents SDK: https://openai.github.io/openai-agents-python/
-- OpenAI Agents SDK tracing: https://openai.github.io/openai-agents-python/tracing/
+- OpenAI Responses background mode: https://developers.openai.com/api/docs/guides/background
+- OpenAI Responses WebSocket mode: https://developers.openai.com/api/docs/guides/websocket-mode
+- OpenAI Responses compaction: https://developers.openai.com/api/docs/guides/compaction
+- OpenAI deferred tool search: https://developers.openai.com/api/docs/guides/tools-tool-search
+- OpenAI agent evals: https://developers.openai.com/api/docs/guides/agent-evals
 - Model Context Protocol: https://modelcontextprotocol.io/docs/getting-started/intro
-- MCP elicitation specification: https://modelcontextprotocol.io/specification/2025-06-18/client/elicitation
+- MCP 2026-07-28 release candidate: https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/
+- MCP Tasks extension: https://modelcontextprotocol.io/extensions/tasks/overview
+- ACP v1 schema: https://agentclientprotocol.com/protocol/v1/schema
 - A2A protocol specification: https://a2a-protocol.org/latest/specification/
+- A2A JavaScript SDK: https://github.com/a2aproject/a2a-js
+- Open Agent Skills specification: https://openagentskills.dev/docs/specification
+- OpenTelemetry GenAI semantic conventions: https://opentelemetry.io/docs/specs/semconv/registry/attributes/gen-ai/
+- OWASP AI Agent Security Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/AI_Agent_Security_Cheat_Sheet.html
+- OWASP Agent Memory Guard: https://owasp.org/www-project-agent-memory-guard/
 - LangGraph overview: https://docs.langchain.com/oss/python/langgraph/overview
-- OpenAI computer use guide: https://platform.openai.com/docs/guides/tools-computer-use
+- OpenAI computer use guide: https://developers.openai.com/api/docs/guides/tools-computer-use
 - Ollama docs: https://docs.ollama.com/
-- MCP authorization specification: https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization
-- MCP security best practices: https://modelcontextprotocol.io/specification/2025-06-18/basic/security_best_practices
+- MCP authorization specification: https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization
+- MCP security best practices: https://modelcontextprotocol.io/specification/2025-11-25/basic/security_best_practices

package/docs/CONFIGURATION.md

@@ -311,7 +311,7 @@ Behaviour is controlled by environment variables:
 ```sh
 # Overall mode (default: strict) — controls the L1 gates
 UR_VERIFIER_MODE=strict   # all L1 gates on: done-claim, loops, empty turn,
-                          # project gates
+                          # project gates; approval is requested once per user turn
 UR_VERIFIER_MODE=loose    # only empty-turn check + loop detector
 UR_VERIFIER_MODE=off      # disable verifier entirely
 
@@ -447,10 +447,47 @@ ur mcp list
 ur mcp get <name>
 ur mcp add-json <name> '<json>'
 ur mcp remove <name>
+ur mcp serve
 ```
 
 MCP servers may execute code or access external services. Only enable servers you trust, and keep credentials out of committed config.
 
+When UR itself runs as an MCP server, tool requests are non-interactive:
+schema validation and normal permission checks still run, and any operation
+that would require an approval prompt is rejected. Resource limits can be
+adjusted with `UR_MCP_MAX_CALLS_PER_MINUTE`,
+`UR_MCP_MAX_CONCURRENT_CALLS`, `UR_MCP_TOOL_TIMEOUT_MS`,
+`UR_MCP_MAX_INPUT_CHARS`, and `UR_MCP_MAX_OUTPUT_CHARS`.
+
+## Background Agents
+
+Detached `ur bg` task state is stored under `.ur/background/`. Manifest updates
+use a cross-process lock and atomic mode-`0600` replacement; task logs, outputs,
+and steering inboxes are created mode `0600` under mode-`0700` directories.
+The loader rejects corrupt, oversized, or structurally invalid manifests rather
+than silently replacing them. `UR_BACKGROUND_MAX_MANIFEST_BYTES` controls the
+manifest byte ceiling (16 MiB by default, capped at 64 MiB), and
+`UR_BACKGROUND_MAX_TASKS` controls the retained task ceiling (5,000 by default,
+capped at 20,000).
+
+## Agent Servers
+
+For native editor integration, `ur acp stdio` implements stable Agent Client
+Protocol v1 through the official SDK. Its resource controls use the
+`UR_ACP_STDIO_*` prefix. It supports client-provided MCP stdio/HTTP/SSE
+servers, additional workspace roots, native permission requests, cancellation,
+and persistent `session/resume`; see the [ACP Guide](ACP.md).
+
+`ur acp serve` is a separate UR HTTP JSON-RPC API. Set `UR_ACP_TOKEN` instead
+of putting its bearer token in argv. Request, task, and tool limits use the
+`UR_ACP_*` prefix.
+
+`ur a2a serve` exposes the stable official-SDK A2A v0.3 JSON-RPC binding and a
+separate UR compatibility task API. Use `UR_A2A_TOKEN` for a static operator
+token or `UR_A2A_DELEGATION_SECRET` for issuer-minted scoped tokens. Limits use
+the `UR_A2A_*` prefix. See the [A2A Guide](A2A.md) for endpoints, proxy setup,
+scope isolation, and the A2A v1 migration status.
+
 ## Plugins and Skills
 
 Plugins can add commands, tools, and skills:

package/docs/DEVELOPMENT.md

@@ -35,6 +35,7 @@ bun run dev
 ```sh
 bun run typecheck
 bun run lint
+bun run dependencies:audit
 bun test
 bun run build
 bun run smoke